Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-63183OmniAuth: Host Header Injection VulnerabilityRubyGems · omniauth · fixed in 2.2.0
- CVE-2026-63414Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected appsRubyGems · shopify_app · fixed in 23.0.3
- CVE-2026-61848Crass: Non-ASCII characters cause superlinear CPU consumptionRubyGems · crass · fixed in 1.0.7
- CVE-2026-61847Crass: A large number of adjacent CSS comments can trigger a SystemStackErrorRubyGems · crass · fixed in 1.0.7
- CVE-2026-61846Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usageRubyGems · crass · fixed in 1.0.7
- CVE-2026-116695Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypassRubyGems · crass · fixed in 1.0.8
- CVE-2026-107715Mechanize sends credential headers to another host after an HTTP redirectRubyGems · mechanize · fixed in 2.14.1
- CVE-2026-107399Mechanize sends credential headers to another origin after a meta refreshRubyGems · mechanize · fixed in 2.14.1
- CVE-2026-55107Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)RubyGems · kobako · fixed in 0.9.1
- CVE-2026-77602OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)RubyGems · openc3 · fixed in 7.3.0
- CVE-2026-77601OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` settingRubyGems · openc3 · fixed in 7.3.0
- CVE-2026-61570MPXJ: XXE Vulnerability in MerlinReaderRubyGems · mpxj · fixed in 16.4.1
- CVE-2026-65829MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readersRubyGems · mpxj · fixed in 16.5.0
- CVE-2026-94462Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)RubyGems · spree_api · fixed in 5.4.4, 5.5.4
- CVE-2026-44163fluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`RubyGems · fluent-plugin-opentelemetry · fixed in 0.5.3
- CVE-2026-44282Election question titles allow stored script executionRubyGems · decidim-elections · fixed in 0.32.0
- CVE-2026-44162fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`RubyGems · fluent-plugin-s3 · fixed in 1.8.5
- CVE-2026-70658pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifierRubyGems · pay
- CVE-2026-50276dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoSRubyGems · datadog · fixed in 2.32.0
- CVE-2026-57579Alchemy: Unauthenticated nested page API leaks restricted & unpublished contentRubyGems · alchemy_cms · fixed in 8.2.6, 8.1.14, 8.0.15 and more
- CVE-2023-46035The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.RubyGems · svg_optimizer · fixed in 0.3.0
- CVE-2026-53769Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policyRubyGems · avo · fixed in 3.32.0
- CVE-2026-85396rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory PrefixRubyGems · rubyzip · fixed in 3.4.0
- CVE-2026-63435Mail: Email address spoofing via malformed RFC 2047 encoded-wordsRubyGems · mail · fixed in 2.9.1
- CVE-2026-44476Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secretRubyGems · doorkeeper-openid_connect · fixed in 1.10.0
- CVE-2026-79772Nokogiri before 1.19.1 Unchecked Return Value canonicalizeRubyGems · nokogiri · fixed in 1.19.1
- CVE-2026-79771Nokogiri before 1.19.3 Memory Leak via XSLT TransformRubyGems · nokogiri · fixed in 1.19.3
- CVE-2026-79770Nokogiri before 1.19.3 ReDoS via CSS selector tokenizerRubyGems · nokogiri · fixed in 1.19.3
- CVE-2026-73426Trix: Stored XSS vulnerability through serialized attributesRubyGems · action_text-trix · fixed in 2.1.17
- CVE-2026-61666websocket-driver: Denial of service via malformed Host headerRubyGems · websocket-driver · fixed in 0.8.2